On approval of the Rules for issuing and revoking certificates of accreditation of certification centers

Home / Order / On approval of the Rules for issuing and revoking certificates of accreditation of certification centers

Order of the Deputy Prime Minister - Minister of Artificial Intelligence and Digital Development of the Republic of Kazakhstan dated June 17, 2026 No. 324/NK. Registered with the Ministry of Justice of the Republic of Kazakhstan on June 17, 2026 No. 38983

In accordance with paragraph 3 of Article 54 of the Digital Code of the Republic of Kazakhstan, subparagraph 1) of Article 10 of the Law of the Republic of Kazakhstan "On State and Socially Responsible Services" and subparagraph 162) of paragraph 15 of the Regulation on the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan, approved by Resolution of the Government of the Republic of Kazakhstan dated October 9, 2025 No. 846, I ORDER:

1. Approve the attached Rules for issuing and revoking certificates of accreditation of Certification centers.

2. To invalidate certain orders in accordance with the annex to this order.

3. The Information Security Committee of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan, in accordance with the procedure established by the legislation of the Republic of Kazakhstan, shall ensure:

1) the state registration of this order in the Ministry of Justice of the Republic of Kazakhstan;

2) posting of this order on the Internet resource of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan after its official publication;

3) within ten working days after the state registration of this order with the Ministry of Justice of the Republic of Kazakhstan, submit to the Legal Department of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan information on the implementation of measures provided for in subparagraphs 1) and 2) of this paragraph.

4. Control over the execution of this order is entrusted to the supervising Vice Minister of Artificial Intelligence and Digital Development of the Republic of Kazakhstan.

5. This order will enter into force on July 12, 2026 and is subject to official publication.

Deputy Prime Minister – Minister of Artificial Intelligence and Digital Development of the Republic of Kazakhstan

J. Madiev

"APPROVED" by the Ministry of Trade and Integration of the Republic of Kazakhstan

"APPROVED" by the National Security Committee of the Republic of Kazakhstan

Approved by the Order of the Deputy Prime Minister - Minister of Artificial Intelligence and Digital Development of the Republic of Kazakhstan dated June 17, 2026 No. 324/NK

Rules for issuing and revoking certificates of accreditation of certification centers

Chapter 1. General provisions

1. These Rules for issuing and revoking certificates of accreditation of certification centers (hereinafter referred to as – The Rules) were developed in accordance with paragraph 3 of Article 54 of the Digital Code of the Republic of Kazakhstan, subparagraph 1) of Article 10 of the Law of the Republic of Kazakhstan "On State and Socially Responsible Services" and subparagraph 162) of paragraph 15 of the Regulation on the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan, approved by Resolution of the Government of the Republic of Kazakhstan dated October 9, 2025 No. 846 and determine the procedure for issuing and revoking certificates of accreditation of certification centers.

2. The following concepts are used in these Rules:

1) a means of cryptographic information protection (hereinafter referred to as SCSI) is software or a hardware and software package that implements algorithms for cryptographic transformations, generation, formation, distribution or management of encryption keys;

2) The root certification Center of the Republic of Kazakhstan is a certification center that confirms the ownership and validity of the public keys of the electronic digital signature of the certification centers.

3. The state service "Accreditation of Certification Centers" (hereinafter referred to as the state service) is provided by the Information Security Committee of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan (hereinafter referred to as the service provider) to legal entities (hereinafter referred to as the service recipient). The state service is provided on the basis of an act on the results of a survey of the service recipient, in order to assess compliance with these Rules, as well as the requirements established by the digital legislation of the Republic of Kazakhstan. The examination of the service recipient is carried out by the commission on accreditation of certification centers (hereinafter referred to as the commission), the composition of which is determined by the order of the service provider. The Commission consists of representatives of the service provider, the authorized body for technical regulation and the National Institute for Development in the field of cybersecurity.

4. The information is sent by the Service provider to a Single Contact Center and posted on a single platform of Internet resources of the state bodies of the Republic of Kazakhstan within 10 (ten) business days from the date of introduction of amendments and (or) additions to these Rules. www.gov.kz in the section "Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan".

Chapter 2. Procedure for issuing certificates of accreditation of certification centers

5. The list of basic requirements for the provision of public services is set out in Appendix 1 to these Rules (hereinafter referred to as the List).

6. In order to obtain the certificate of accreditation of the certification center (hereinafter referred to as the certificate of accreditation), the service recipient submits to the service provider through the digital Government web portal www.egov.kz (hereinafter referred to as the portal) documents in accordance with item 8 of the List with a completed application form in accordance with Appendix 2 to these Rules.

7. On the day of receipt of the application, the service provider accepts and registers them, and sends them to an employee of the responsible structural unit of the service provider (hereinafter referred to as the service provider's employee) for execution.

If the recipient applies after the end of working hours, on weekends and holidays, applications are accepted and the results of the provision of public services are issued on the following business day.

When the service recipient submits an application through the portal, the status of acceptance of the request for the provision of public services is sent to the "personal account", as well as a notification indicating the date and time of receipt of the result of the provision of public services.

8. An employee of the service provider shall, within two (2) business days from the date of registration of the application, verify the availability of the submitted documents in accordance with the List specified in paragraph 5 of these Rules.

9. If it is established that the submitted documents do not comply with the List specified in paragraph 5 of these Rules, the service provider, through the portal, sends a reasoned refusal to further consider the application.

10. If there are no grounds for refusal, the service provider notifies the service recipient about the commission's examination within 5 (five) business days through the portal. The examination is carried out by the commission in two stages: documentary and on-site.

11. On the day of sending the notification to the service recipient, the service provider sends a letter to the members of the commission on conducting an examination of the service recipient.

12. The Commission, within 3 (three) business days from the date of notification of the service recipient, conducts a documentary examination of the content of the documents specified in paragraph 5 of these Rules.

Familiarizes himself with the acts based on the results of previous surveys, if any.

If it is established that the submitted documents do not comply with the legislation of the Republic of Kazakhstan and/or the content does not comply with the legislation of the Republic of Kazakhstan, the service provider, based on a decision of the commission drawn up by the protocol, sends a reasoned refusal to further consider the application through the portal.

If there are no grounds for refusal based on the results of the documentary verification, the service provider notifies the service recipient through the portal within 5 (five) business days about the conduct of his on-site inspection by the commission at the location of the infrastructure of the certification center.

The on-site examination is carried out by the commission within 6 (six) working days from the date of notification of its conduct.

During the on-site examination of the service recipient, the commission determines the compliance of the documents submitted for accreditation with the actual situation and determines:

1) compatibility of the used SCSI used by the service recipient with the Root Certification Center of the Republic of Kazakhstan;

2) verification of the construction of a correct chain of electronic digital signature public key certificates from the electronic digital signature public key certificate of the Root Certifying Center of the Republic of Kazakhstan to the electronic digital signature public key certificate of the user of the service recipient using the SCSI of the service recipient;

3) the presence of object identifiers registered by the authorized body in electronic digital signature public key certificates issued by the service recipient;

4) a mechanism for verifying the construction of a valid chain of electronic digital signature public key certificates;

5) Registered Object identifiers (OIDs);

6) Server room;

7) Communication channels used;

8) the procedure for synchronizing the time of the accredited service recipient with a set of technical means that ensure the periodic transmission of digital information about the current time value from the standard unit of time of the Republic of Kazakhstan, satellite global positioning systems, generally recognized international sources (hereinafter referred to as the accurate time system);

9) the unified accounting and reporting time of the accredited service recipient in accordance with the Law of the Republic of Kazakhstan "On Communications";

10) services provided by the service recipient;

11) the service recipient's infrastructure (certification center and registration centers);

12) availability of physical primary and backup servers;

13) access to the list of revoked electronic digital signature public key certificates;

14) availability of the main and backup hardware and software protection systems for root cryptographic keys;

15) Server room requirements:

availability of an uninterruptible power supply;

availability of an air conditioning system;

finding servers in a non-residential building;

connecting the server room equipment to the main electrode of the building's grounding system with a conduit measuring at least 1.5 centimeters;

The ceiling height of the server room must be at least 2.44 meters.;

automatic warning and fire extinguishing system;

limited access to the server room, access control.

16) providing certificates of electronic digital signature of users, as well as information about their revocation to the root certification center of the Republic of Kazakhstan;

17) the availability of the function of revoking electronic digital signature certificates upon request from the owner, signed with the private key of the electronic digital signature, the electronic digital signature certificate of which was issued by the national certification center of the Republic of Kazakhstan.

13. On the day of completion of the examination, an act on the results of the examination (hereinafter referred to as the act) is drawn up, which indicates the actual condition of the service recipient, conclusions and recommendations.

The act is signed by all members of the commission.

If a member of the commission does not agree with the decision taken and does not sign the act, he/she informs the service provider with justification of the reasons.

The act is considered adopted if two thirds of the signatures of the commission members are present.

14. The service provider, within the next business day after the adoption of the act, decides whether to issue or refuse to issue a certificate of accreditation of the certification center.

15. The service provider, through the portal, within 1 (one) business day after the decision is made, issues to the service recipient an accreditation certificate in the form of an electronic document signed with an electronic digital signature of the authorized person of the service provider, in accordance with Appendix 3 to these Rules, valid for three years, or sends a reasoned refusal to issue an accreditation certificate.

16. The grounds for refusal to provide public services are set out in Appendix 1 to these Rules.

17. The service provider ensures that data on the stage of provision of public services is entered into the digital monitoring system for the provision of public services, in accordance with the Order of the Acting Minister of Transport and Communications of the Republic of Kazakhstan dated June 14, 2013 No. 452 "On Approval of the Rules for Entering Data into the information system for monitoring the provision of public services on the stage of provision of public services" (registered in the Register of State registration of regulatory legal acts for No. 8555).

The service provider maintains a register of issued and revoked certificates of accreditation of certification centers.

18. Based on the certificate of accreditation, the service recipient applies to the Root Certification Center of the Republic of Kazakhstan for registration (re-registration) of the certificate of the public key of the electronic digital signature of the service recipient.

Chapter 3. Procedure for revocation of the certificate of accreditation of certification centers

19. The revocation of the certificate of accreditation of the certification center is carried out on the following grounds:

1) in case of re-registration, as well as termination of the activity of a legal entity (service recipient);

2) in case of non-fulfillment, without justified reasons, within the prescribed time, of written recommendations on the elimination of violations identified in accordance with the procedure provided for in paragraphs 21, 22 and 23 of these Rules, which caused damage to users of the certification center.

20. In case of re-registration, as well as termination of the activity of a legal entity (service recipient), the service recipient sends a notification to the service provider indicating the time required to complete all procedures provided for by the legislation of the Republic of Kazakhstan.

After the expiration of the period specified in the notification, the service provider decides to revoke the certificate of accreditation of the certification center.

21. Within 3 (three) business days from the date of receipt of an appeal (complaint, statement) from individuals and legal entities on violation of the requirements of these Rules, the service provider shall request (demand) the service recipient has explanations on the issues specified in the information.

Based on the results of reviewing the explanation and establishing the fact of violation of the requirements of these Rules, as well as confirmation of the violation by the service recipient, the service provider sends recommendations for the elimination of violations, indicating the time limit for the elimination of violations, which may not exceed 60 (sixty) business days from the date the service recipient receives the recommendation of the service provider.

The service recipient sends the service provider an explanation with objections to the appeals (complaints, statements) of individuals and legal entities, and the service provider considers it.

If the service provider receives an explanation from the service recipient about the need for improvements to eliminate violations for a period of more than 60 (sixty) business days, the period sufficient to eliminate violations will be determined by agreement between the service recipient and the service provider.

If, at the request of the service recipient, an explanation of the violation of the requirements of these Rules is not provided within 30 (thirty) business days, as well as unjustified disagreement with the violation on the part of the service recipient, the service provider shall notify him of the date and subject of the on-site inspection by the commission at the location of the certification center infrastructure.

The on-site examination is carried out by the commission within 6 (six) working days from the date of notification of its conduct.

22. The on-site examination is carried out by the commission.

The Commission consists of the Chairman, the secretary and the members of the commission. The number of members of the commission consists of at least 5 (five) persons.

An act is drawn up based on the results of the on-site examination.

An act is considered valid if it has been signed by at least 3 (three) persons from the total number of its members, with the exception of the secretary.

In the absence of violations of the requirements of these Rules, a corresponding mark is made in the act.

In case of violations of the requirements of these Rules, the service provider makes a decision to revoke the certificate of accreditation.

The service recipient sends the service provider his explanation of objections to the act, and the service provider reviews it and informs the service recipient of the results of the review.

If the service provider receives an explanation from the service recipient with objections to the act on the need for improvements to eliminate violations for a period of more than 60 (sixty) business days, the period sufficient to eliminate violations is determined by agreement between the service recipient and the service provider.

23. Upon expiration of the period for the elimination of violations specified in the recommendation on the elimination of violations, the service recipient provides the service provider with information on the elimination of identified violations.

If the service recipient fails to provide information on the implementation of recommendations for the elimination of violations within the prescribed period, the service provider shall, within two (2) business days, send the service recipient a request for information on the implementation of recommendations for the elimination of violations.

In case of failure to provide information within the specified period, the service provider decides to revoke the certificate of accreditation of the certification center.

24. In case of changes in the operating conditions and functionality of the certification center, the service recipient shall send information about all changes to the service provider within 10 (ten) business days.

In case of discrepancies in the specific characteristics of the certification center, the service provider decides to send recommendations to eliminate violations, as well as to bring the actual position of the certification center in line with the digital legislation of the Republic of Kazakhstan.

If the service recipient fails to take the necessary measures resulting from the recommendation, the service provider decides on an on-site inspection by the commission at the location of the certification center's infrastructure in accordance with the procedure provided for in paragraphs 21, 22 and 23 of these Rules.

Appendix 1 to the Rules for issuing and revoking certificates of accreditation of credentialing centers

List of basic requirements for the provision of public services

"Accreditation of certification centers"

Download

Name of the public service

Accreditation of certification centers

Name of the subspecies (if any) of the public service

1) Issuance of the certificate of accreditation of certification centers; 2) Revocation of the certificate of accreditation of certification centers.

Name of the service provider

Information Security Committee of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan

Methods of providing public services and their subspecies (if any)

Through the Digital Government web portal.

The duration of the provision of public services and their subspecies (if any)

The delivery period is 13 (thirteen) business days from the date of registration of the application in the office.

The form of public service provision and its subspecies (if any)

Electronic.

The result of the provision of public services and their subspecies (if any)

Issuance of a certificate of accreditation of the certification center, or a reasoned response on refusal to provide public services.The result of the provision of public services is sent and stored in the "personal account" of the service recipient in the form of an electronic document signed with an electronic digital signature of an authorized person of the service provider.The form of providing the result of the provision of public services: electronic

The amount of the fee charged to the service recipient for the provision of public services and their subspecies (if any), and the methods of its collection in cases provided for by the legislation of the Republic of Kazakhstan

Public services are provided free of charge to legal entities.

Work schedule of the service provider, State Corporation and information facilities

1) service provider – from Monday to Friday, in accordance with the established work schedule from 8.00 to 17.30 hours, with the exception of weekends and holidays, according to the Labor Code of the Republic of Kazakhstan with a lunch break from 13.00 to 14.30 hours.2) the portal is open around the clock, except for interruptions related to technical work.Addresses of places where public services are provided are posted on:1) the Internet resource of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan – www.gov.kz/memleket/entities/mdai ;2) the portal.

10.

List of documents and information required from the service recipient for the provision of public services and their subspecies (if any)

an application for the issuance of a certificate of accreditation of the certification center; an electronic copy of licenses and (or) certificates for the software used for non-free distribution, as well as documents confirming copyrights, in the case of proprietary development; an electronic copy of the test results for the service recipient's compliance with cybersecurity requirements, in the case of integration with government digital systems; an electronic copy of the interaction schemes of the service recipient's modules (components) and the electronic digital signature scheme with data on the applied cryptographic transformation algorithms and other source data (basic requirements) for the implementation of the electronic digital signature formation process and requirements for individual parameters of the service recipient, approved by the service recipient; information in electronic form on the actual the location of the primary and backup servers, the main and backup hardware and software complexes for protecting the root cryptographic keys of the certification center, including information about the serial number, model and manufacturer; electronic copies of approved regulatory and technical documents regulating:cybersecurity policy of the service recipient; regulations or rules of operation of the service recipient; policy for the use of electronic digital signature public key certificates; regulations on the certification center; an electronic copy of the instructions for the actions of employees, performing work on behalf of the service recipient directly involved in the maintenance, administration, and issuance of certificates of public keys of the electronic digital signature of the service recipient in emergency, crisis situations; an electronic copy of instructions on backup of digital resources of the service recipient; an electronic copy of instructions for installing and configuring the software of the service recipient; an electronic copy of certificates of conformity for the used means of cryptographic information protection ST RK 1073-2007 "Means of cryptographic information protection. General technical requirements" are not lower than the second level, which are applied by the service recipient and its users.

11.

Grounds for refusal to provide public services and their subspecies (if any), established by the laws of the Republic of Kazakhstan

1) establishing the unreliability of documents submitted by the service recipient to receive a public service and (or) the data (information) contained therein; 2) non-compliance of the service recipient and (or) the submitted materials, objects, data and information necessary for the provision of public services with the requirements established by regulatory legal acts of the Republic of Kazakhstan; 3) the negative response of the authorized state body to the request for approval, which is required for the provision of public services, as well as a negative expert opinion, research or verification; 4) in respect of the service recipient, there is a court decision (verdict) that has entered into force prohibiting activities or certain types of activities that require obtaining a certain public service; 5) in respect of the service recipient, there is a court decision that has entered into force, on the basis of which the service recipient is deprived of a special right related to receiving a public service.

Appendix 2 to the Rules for Issuing and revoking certificates of Accreditation of Trusting Centers in the Committee on Information Security of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan

Application for the issuance of the certificate of accreditation of the certification center __________________________________________________________________ name of the certifying center, legal address, phone number, please issue a certificate of accreditation of the certifying center __________________________________________________________________ I agree to the use of information that constitutes a legally protected secret contained in digital systems. Date "___" _______________ 20__ G. Chief Executive Officer______________________________ ( signature) last name, first name, patronymic (if any)

Appendix 3 to the Rules for issuing and revoking certificates of accreditation of credentialing centers

Download

Kazakhstan Republicasand intelligence zhanecifrlyk damu Ministerligininakparattyk kapsizdik komiti

Committee on Information Security of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan

Certificate of accreditation of the certification center No. ____

This certificate has been issued: _______________________________________________________________, (name of the legal entity) located at: _______________________________________________________________, ( address of the legal entity) to be recognized by the Information Security Committee of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan _______________________________________________________________ accredited in accordance with the Rules of accreditation of certification centers, on the basis of the act on the results of the examination of the certification center _________________________________________ ___________________________. The validity period of this certificate of accreditation of certification centers is 3 years from the date of issue and is valid throughout the territory of the Republic of Kazakhstan. Position Last name, first name, patronymic (if any)

Appendix to the Order of the Deputy Prime Minister - Minister of Artificial Intelligence and Digital Development of the Republic of Kazakhstan On June 17, 2026 No. 324/NK

List of expired orders

1. Order of the Minister of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan dated June 1, 2020 No. 224/NK "Rules for issuing and revoking certificates of accreditation of certification centers" (registered in the Register of State Registration of Regulatory Legal Acts No. 20815).

2. Order of the Minister of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan dated September 30, 2022 No. 363/NK "On Amendments to the Order of the Minister of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan dated June 1, 2020 No. 224/NK "On Approval of the Rules for Accreditation of Certification Centers" (registered in the Register of State Registration regulatory legal acts No. 29960).

3. Order of the Minister of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan dated April 17, 2023 No. 155/NK "On Amendments to the Order of the Minister of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan dated June 1, 2020 No. 224/NK "On Approval of the Rules for Issuing and Revoking Certificates of Accreditation of Certification Centers" (registered in the Register of State Registration of Regulatory Legal Acts No. 32341).

Constitution Law Code Standard Decree Order Decision Resolution Lawyer Almaty Lawyer Legal service Legal advice Civil Criminal Administrative cases Disputes Defense Arbitration Law Company Kazakhstan Law Firm Court Cases Declaration Decree Order Resolution Decision Report Conclusion Statement Conclusion Convention Contract Memorandum Methodology Norms Note Rules Program Charter Charter Article Commentary Resolution Regulations Protocol Draft Program Rules Messages